Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions list.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1058 Stored XSS Vulnerability in WordPress Form Maker Plugin via Hidden Field Values https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1058
Post summary
A stored XSS vulnerability has been disclosed for the WordPress Form Maker Plugin, exploiting hidden field values, as recorded in a vulnerability database.
CVE-2026-1058 The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to i… https://www.cve.org/CVERecord?id=CVE-2026-1058
Post summary
The Form Maker plugin for WordPress is vulnerable to stored XSS via hidden field values in all versions up to 1.15.35, as detailed in CVE-2026-1058.